Closed
Case 01 · FlagshipClosed
Fleet-wide Chrome vulnerability exposure closed in one day
ProblemAn EY security assessment flagged 529,644 Chrome vulnerabilities across 1,449 devices, 66% of everything it found. Two conflicting Chrome update rules in Workspace ONE pushed different versions to the same devices, and Chrome's built-in updater had silently stopped working on affected machines, in some cases for up to two years.
What I didI removed the conflicting rules, cleaned duplicate and stale Chrome entries out of the device catalog, and put one enforced update policy in place fleet-wide. I delivered an executive brief to leadership.
80%
Same day, devices on the fixed version went from 751 to 1,389 (43% to 80% of the 1,728 targeted), closing roughly 507,000 of the ~523,000 credited vulnerability instances.
Traced
Case 02 · ArchitectureRoot cause found
Workspace ONE architecture gap: 46% of fleet vulnerabilities traced to 97 abandoned machines
ProblemA Workspace ONE Windows Update profile was reaching 130 of 1,737 devices. The cause was architectural, not a misconfiguration.
What I didA test profile proved CSP and OMA-DM profiles only reach the 123 UEM Managed endpoints, while ADMX profiles through Intelligent Hub reach all 1,730. Every OMA-DM profile in the tenant had been covering 7% of the fleet, and Intune is the real MDM authority for 1,608 devices. I joined CrowdStrike Falcon, Intune, Entra ID and Workspace ONE data to classify all 1,696 Windows endpoints, then delivered an executive brief, a training guide, and a workbook splitting the 107 machines worth retiring from the 328 still in daily use.
97
97 abandoned computers, 6% of the fleet, were generating 46% of the 171,307 open vulnerabilities. 160 staff held 357 computers between them, one person nine.
Rebuilt
Case 03 · Cloudflare WorkersShipped
Rebuilt Pheme on Cloudflare Workers with a zero-loss cutover
ProblemThe company's live-call dashboard needed a full rebuild on Cloudflare Workers, a stateless, event-driven runtime where the old Node.js assumptions do not survive.
What I didI reworked process lifecycle, storage, scheduling and WebSocket transport around how Workers actually execute, keeping every business rule intact. I stood up Durable Object state, KV storage, and Cloudflare Access with Entra ID SSO, and wrote a 122-test suite that runs against the live Workers runtime.
158
The suite caught 3 runtime-specific bugs standard testing never would have. The cutover lost nothing: live-call visibility stayed continuous across 158 locations doing 10,000+ calls a day.
Contained
Case 04 · ContainmentContained
15,461 CVE instances contained on 7 endpoints
ProblemSeven endpoints carried 15,461 CVE instances: 16.5% of total fleet exposure on 8% of machines, 2.25x the fleet norm. 357 of those CVEs existed nowhere else.
What I didI applied reversible containment controls per playbook first, then traced the root cause: seven devices that never finished decommissioning, five of them superseded hardware.
7/7
All seven endpoints contained with reversible controls. The real finding was the broken decommissioning process, packaged into an executive summary for director review.